xbeji Privacy Policy — How We Handle Your Data

When you use the xbeji platform — whether browsing as a guest, registering an account, making a deposit, or engaging with any of our casino or sports betting products — we may collect and process certain categories of personal information. xbeji is committed to being transparent about exactly what information we collect and why. The categories of data we collect are set out below.

1.1 Information You Provide Directly

This is information you voluntarily submit to xbeji during registration, account management, or when contacting our support team. It includes:

• Identity data: Your full legal name, date of birth, gender, and nationality as provided during account registration or KYC verification.
• Contact data: Your Bangladeshi mobile number, email address, and residential address (including city — e.g., Dhaka, Chittagong, Sylhet, Khulna, or Rajshahi).
• Identity documents: Scanned or photographed copies of your National ID Card (NID), passport, or driving licence submitted as part of our Know Your Customer (KYC) verification process.
• Financial data: Payment method details used for deposits and withdrawals, including your bKash or Nagad mobile wallet number, Rocket or Upay account reference, or masked card details for Visa/Mastercard transactions. xbeji does not store full card numbers — these are handled by our PCI-DSS compliant payment processors.
• Account credentials: Your chosen username and an encrypted hash of your password. xbeji never stores passwords in plain text.
• Support correspondence: The content of any messages you send to xbeji through live chat, email to [email protected], or any other support channel.

1.2 Information Collected Automatically

When you access and use the xbeji platform, certain technical and behavioural data is collected automatically through your browser or device. This includes:

• Device and technical data: IP address, browser type and version, operating system, screen resolution, device type (mobile, tablet, desktop), and mobile network operator.
• Usage data: Pages visited, time spent on each page, games played, bet amounts and outcomes, bonus activity, deposit and withdrawal history, and session duration.
• Location data: General geographic location inferred from your IP address (country and city level). xbeji does not access GPS-level location data from your device.
• Cookie and tracking data: Data collected via cookies, local storage, and similar technologies as described in Section 4 of this Privacy Policy.

1.3 Information from Third Parties

In some cases, xbeji may receive personal data about you from third-party sources, including identity verification service providers used to fulfil our KYC obligations, payment processors who confirm the status of your transactions, and fraud detection agencies. Any data received from third parties is handled with the same standard of care and in accordance with the same principles set out in this Privacy Policy.

xbeji processes the personal data we collect for specific, legitimate purposes. We do not use your data in ways that are incompatible with the purposes for which it was originally collected. The table below sets out the primary purposes for which xbeji processes personal data and the corresponding lawful basis for each.

2.1 Marketing Communications

xbeji may send you promotional emails or SMS messages about new games, bonuses, special offers, and platform updates — but only if you have given your explicit consent to receive such communications during registration or through your account preferences settings. You may withdraw your consent and opt out of marketing communications at any time by updating your notification preferences in the xbeji account settings panel, or by contacting our support team at [email protected].

Withdrawing consent to marketing communications does not affect xbeji's ability to send you transactional communications that are necessary for the administration of your account — such as deposit confirmations, withdrawal notifications, security alerts, and responses to support enquiries.

2.2 Automated Decision-Making

xbeji's fraud prevention and responsible gaming systems may use automated processes to analyse account behaviour and identify patterns that may indicate fraudulent activity, underage use, or problematic gambling behaviour. Where an automated process results in a material decision affecting your account — such as a temporary suspension or a withdrawal delay — you have the right to request human review of that decision by contacting our support team.

xbeji may share your personal data with third parties only in the following circumstances:

3.1 Service Providers and Data Processors

xbeji works with a limited number of carefully selected third-party service providers who process personal data on our behalf as data processors. These include payment processing partners (including those handling bKash, Nagad, Rocket, Upay, Visa, and Mastercard transactions), identity verification and KYC service providers, customer support platform providers, IT infrastructure and cloud hosting providers, and fraud detection and cybersecurity firms. All such service providers are contractually bound to process your data only in accordance with xbeji's instructions and to maintain appropriate technical and organisational security measures.

3.2 Game Providers

xbeji integrates games from third-party studios including Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe. When you play a game provided by one of these studios, certain technical data — such as your session token and bet history within that game — may be processed by the relevant studio's game server infrastructure. These studios are contractually bound not to use that data for purposes beyond the delivery of the game session.

3.3 Legal and Regulatory Disclosure

xbeji may be required to disclose personal data to competent authorities, law enforcement agencies, or regulatory bodies where such disclosure is required by applicable law, by court order, or in connection with the investigation of suspected illegal activity including money laundering, fraud, or underage gambling. In such cases, xbeji will disclose only the minimum data necessary to fulfil the legal obligation and will make reasonable efforts to notify the affected user of the disclosure where permitted to do so by law.

3.4 Business Transfers

In the event that xbeji undergoes a merger, acquisition, restructuring, or sale of all or part of its business assets, your personal data may be transferred to the acquiring entity as part of that transaction. In such circumstances, xbeji will take reasonable steps to ensure that the acquiring entity provides privacy protections that are no less stringent than those set out in this Privacy Policy, and you will be notified of any material change in how your data is handled.

xbeji uses cookies and similar tracking technologies (including local storage, session storage, and pixel tags) to operate the platform, remember your preferences, analyse site usage, and support our fraud prevention systems. This section explains what cookies we use, why we use them, and how you can manage your cookie preferences.

4.1 Types of Cookies Used by xbeji

4.2 Managing Your Cookie Preferences

You can control and manage cookies through your web browser settings. Most modern browsers allow you to view which cookies are stored, block specific categories of cookies, and delete all cookies associated with a website. Please note that disabling essential cookies may prevent you from logging in or using core features of the xbeji platform. Disabling analytics or preference cookies will not affect your ability to play games or make transactions, but may result in a less personalised experience.

For detailed guidance on managing cookies in your specific browser, refer to the help documentation provided by your browser developer. Common browsers used in Bangladesh include Google Chrome for Android (widely used on mobile), Samsung Internet, Mozilla Firefox, and Opera Mini. Each of these supports cookie management through their respective settings menus.

5.1 Technical Security Measures

xbeji employs a range of technical measures to protect your personal data from unauthorised access, disclosure, alteration, or destruction. These measures include end-to-end TLS 1.3 encryption for all data transmitted between your device and xbeji's servers, AES-256 encryption for sensitive data stored in our databases, bcrypt hashing for all user passwords with a per-user salt, two-factor authentication (2FA) via SMS OTP available to all users, firewall protections and intrusion detection systems on our server infrastructure, and automated monitoring for unusual account access patterns that may indicate credential stuffing or brute-force attacks.

5.2 Organisational Security Measures

Access to personal data held by xbeji is restricted to employees and contractors who have a genuine business need to access that data in order to perform their role. All such personnel are subject to strict confidentiality obligations and receive regular data protection training. Access rights are reviewed periodically and revoked immediately upon termination of employment or contract.

5.3 Data Retention

xbeji retains personal data for the following standard periods, unless a longer retention period is required by applicable law:

• Account and identity data: Retained for a minimum of 5 years following account closure, in accordance with anti-money laundering (AML) record-keeping requirements.
• Transaction and financial data: Retained for a minimum of 5 years from the date of each transaction.
• Support correspondence: Retained for 3 years from the date of the last interaction in a support thread.
• Analytics and usage data: Retained in aggregated, anonymised form for up to 3 years for the purpose of platform improvement analysis.
• Marketing consent records: Retained for 3 years from the date of consent or until consent is withdrawn, whichever is earlier.

When personal data is no longer required and no legal obligation requires its retention, xbeji will securely delete or anonymise that data so that it can no longer be associated with any identifiable individual.

5.4 Data Breach Response

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected users, xbeji will take immediate steps to contain the breach, assess the scope and impact, and notify affected users without undue delay. Notifications will be sent to the contact email or mobile number associated with the affected account and will include a clear description of the nature of the breach, the categories of data involved, the likely consequences, and the steps xbeji has taken or proposes to take to address the breach.

As an xbeji user, you have a number of rights in relation to the personal data we hold about you. xbeji is committed to honouring these rights and has procedures in place to handle requests promptly and fairly. To exercise any of the rights described below, please contact our support team at [email protected] with the subject line "Privacy Rights Request" and include your registered username or mobile number to help us locate your account efficiently.

• Right of access: You have the right to request a copy of the personal data xbeji holds about you and to receive information about how that data is being processed. We will respond to access requests within 30 days.
• Right to rectification: If any personal data held by xbeji is inaccurate or incomplete, you have the right to request that it be corrected or updated. You can update many account details directly through the xbeji account settings panel.
• Right to erasure: In certain circumstances you may request that xbeji delete your personal data. This right is not absolute — we may be required to retain certain data to comply with our legal obligations (e.g., AML record-keeping requirements) — but where deletion is permissible, we will action your request without undue delay.
• Right to restriction of processing: You may request that xbeji restrict the processing of your personal data in certain circumstances, for example while a dispute about the accuracy of your data is being resolved.
• Right to data portability: Where xbeji processes your personal data on the basis of your consent or in performance of a contract, and that processing is carried out by automated means, you have the right to receive a copy of your data in a structured, commonly used, and machine-readable format.
• Right to withdraw consent: Where xbeji processes your data on the basis of your consent (e.g., for marketing communications), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
• Right to object: You may object to xbeji processing your personal data where that processing is based on legitimate interest. If you raise an objection, xbeji will review whether its legitimate interests override your rights and will cease processing if they do not.

The xbeji platform integrates with a number of third-party services that are necessary for the delivery of our products and services. These include game content providers (such as Pragmatic Play, Evolution Gaming, NetEnt, Microgaming, Ezugi, and Spribe), payment processors (handling transactions via bKash, Nagad, Rocket, Upay, Visa, and Mastercard), customer support and live chat infrastructure providers, and analytics and platform monitoring tools.

Each of these third-party services operates under its own privacy policy and data processing terms. While xbeji contractually requires all third-party processors to maintain appropriate data protection standards, xbeji cannot be held responsible for the independent privacy practices of third-party data controllers. We encourage you to review the privacy policies of any third-party services you interact with in connection with your use of xbeji.

xbeji does not embed third-party social media trackers or advertising pixels on its platform. We do not operate a Facebook Pixel, Google Ads remarketing tag, or similar cross-site tracking technology that would allow third-party ad networks to build a profile of your browsing behaviour beyond the xbeji website.

xbeji reserves the right to update or revise this Privacy Policy at any time. Changes may be made to reflect updates to our platform and services, changes in applicable law or regulatory guidance, feedback from users, or evolving best practices in data protection. The effective date shown at the top of this document will be updated whenever a material change is made.

Where a change to this Privacy Policy is material — meaning it significantly affects how we collect, use, or share your personal data — xbeji will notify registered users via email or SMS to the contact details on their account at least 14 days before the change takes effect. Your continued use of the xbeji platform after the effective date of any updated Privacy Policy constitutes your acceptance of the revised terms.

If you have any questions about this Privacy Policy, or if you wish to raise a concern about how xbeji handles your personal data, please contact us at [email protected]. Our team is available 24 hours a day, 7 days a week, and will respond to privacy-related enquiries within 5 business days.